F5 BIG-IP Access Policy Manager (APM)

About the Device

F5 BIG-IP Access Policy Manager (APM) is a flexible, high-performance access and security solution that provides unified global access to your applications and network. By converging and consolidating remote access, LAN access, web access, and wireless connections within a single management interface and providing simple, easy-to-manage access policies, BIG-IP APM helps you free up valuable IT resources while you cost-effectively secure and scale access.

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

To Configure Remote Syslog

1. Log in to BIG-IP Configuration Utility portal as Administrator.

2. In main tab, navigate to System. 

3. In System, navigate to Logs > Configuration > Remote Logging

4. In Remote Logging, provide below details:

Remote IP: IP Address of CyberHub
Remote Port: 514
Local IP: N/A

5. Click Add

6. Click Update to add the configuration into system.

To Configure BIG-IP DNS to log dns queries and responses

To Create a pool of remote logging servers

1. In the main tab, click DNS > Delivery > Load Balancing > Pools or Local Traffic > Pools.

2. In Pool List, click Create.

3. In New Pool, in Name, type a unique name for the pool.

4. Using the New Members, add the IP address for each remote logging server that you want to include in the pool:

   1. Type the CyberHub IP in the Address or select a node address from the Node List.

   2. In the Service Port, type a service number or select a service name from the list.​​

5. Click Add and then click Finished.

To Create a remote high-speed log destination

1. In the main tab, click System > Logs > Configuration > Log Destinations.

2. In Log Destinations, click Create.

3. In Name, type a unique, identifiable name for this destination.

4. In Type, select Remote High-Speed Log

5. In Pool Name, select the pool of remote log servers to which you want the BIG-IP system to send log messages.

6. In Protocol, select the protocol used by the high-speed logging pool members.

7. Click Finished.

To Create a formatted remote high-speed log destination

1. In main tab, click System > Logs > Configuration > Log Destinations.

2. In Log Destinations, click Create.

3. In Name, type a unique, identifiable name for this destination.

4. In Type, select a formatted logging destination as Remote Syslog. The BIG-IP system is now configured to send a formatted string of text to the log servers.

5. If you have selected Remote Syslog, from the Type list, select a format for the logs, and then from the Forward To select High-Speed Log Destination list, select the destination that points to a pool of remote Syslog servers to which you want the BIG-IP system to send log messages.

6. Click Finished.

To Create a publisher:

1. In main tab, click System > Logs > Configuration > Log Publishers.

2. In Log Publishers, click Create.

3. In Name, type a unique, identifiable name for this publisher.

4. In Destinations, select the destination created above from the Available list, and click << to move the destination to the Selected list.

5. Click Finished.

To Create a custom DNS logging profile for logging DNS queries and responses:

1. In main tab, click DNS > Delivery > Profiles > Other > DNS Logging or Local Traffic > Profiles > Other > DNS Logging.

2. In DNS Logging profile, click Create.

3. In New DNS Logging profile, in Name, type a unique name for the profile.

4. In Log Publisher, select a destination to which the BIG-IP system sends DNS log entries.

5. In Log Queries, ensure that the enabled check box is selected, if you want the BIG-IP system to log all DNS queries.

6. In Log Responses, select the enabled check box, if you want the BIG-IP system to log all DNS responses.

7. In Include Query ID, select the enabled check box, if you want the BIG-IP system to include the query ID sent by the client in the log messages.

8. Click Finished.

To Add the DNS logging profile to the listener

1. In main tab, click DNS > Delivery > Listeners > select DNS listener.

2. In DNS profile, in Service, select the DNS profile that you just configured.

3. Click Update.

Integration Parameters

Parameters required from customer for Integration.